asyncrat | 53b8dcceea2bd8a47b85b8f488e427d8e4ef36565c752749aa728fc6a06a3321

Sharing

Copy URL Twitter E-mail

General

Target
53b8dcceea2bd8a47b85b8f488e427d8e4ef36565c752749aa728fc6a06a3321
Size 45KB
Sample260831-hp2bbayxgv
SHA256 53b8dcceea2bd8a47b85b8f488e427d8e4ef36565c752749aa728fc6a06a3321
MD5 aaf65b5deb409d9fb1db19ab52296616
SHA1 9100d76202ab0b2a45ac6bfb868853d9df16a1e8
SHA512 91e524f788cc27adacd969cc1eed340fa83c36443560e889513dd142f3ab1ea494836be878fd09c58e844ac28404e88c738b7fa994b57a074cfde337dbd0a8ab
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1mGsGx8OHuPI2zjbEgp3iYy2M7nmFydp91Mhm62n:cu6YepTPso2rez323bLpSYy2A7p9jIS3
TLSH
T197232B0037E9812BF2BE4FB898F26145467AF6637603D6492CC441DB5613FC6DA426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zorvec.name:80
zorvec.name:22
zorvec.name:8080
zorvec.name:8880
zorvec.name:2052
zorvec.name:2082
zorvec.name:2086
zorvec.name:2095
zorvec.name:443
zorvec.name:2053
zorvec.name:2083
zorvec.name:2087
zorvec.name:2096
zorvec.name:8443
www.zorvec.name:80
www.zorvec.name:22
www.zorvec.name:8080
www.zorvec.name:8880
www.zorvec.name:2052
www.zorvec.name:2082
www.zorvec.name:2086
www.zorvec.name:2095
www.zorvec.name:443
www.zorvec.name:2053
www.zorvec.name:2083
www.zorvec.name:2087
www.zorvec.name:2096
www.zorvec.name:8443
trickbot.zorvec.name:80
trickbot.zorvec.name:22
trickbot.zorvec.name:8080
trickbot.zorvec.name:8880
trickbot.zorvec.name:2052
trickbot.zorvec.name:2082
trickbot.zorvec.name:2086
trickbot.zorvec.name:2095
trickbot.zorvec.name:443
trickbot.zorvec.name:2053
trickbot.zorvec.name:2083
trickbot.zorvec.name:2087
trickbot.zorvec.name:2096
trickbot.zorvec.name:8443
industroyer.zorvec.name:80
industroyer.zorvec.name:22
industroyer.zorvec.name:8080
industroyer.zorvec.name:8880
industroyer.zorvec.name:2052
industroyer.zorvec.name:2082
industroyer.zorvec.name:2086
industroyer.zorvec.name:2095
industroyer.zorvec.name:443
industroyer.zorvec.name:2053
industroyer.zorvec.name:2083
industroyer.zorvec.name:2087
industroyer.zorvec.name:2096
industroyer.zorvec.name:8443
hermeticwiper.zorvec.name:80
hermeticwiper.zorvec.name:22
hermeticwiper.zorvec.name:8080
hermeticwiper.zorvec.name:8880
hermeticwiper.zorvec.name:2052
hermeticwiper.zorvec.name:2082
hermeticwiper.zorvec.name:2086
hermeticwiper.zorvec.name:2095
hermeticwiper.zorvec.name:443
hermeticwiper.zorvec.name:2053
hermeticwiper.zorvec.name:2083
hermeticwiper.zorvec.name:2087
hermeticwiper.zorvec.name:2096
hermeticwiper.zorvec.name:8443

Mutex

4EKWZXn0c21M

Attributes

delay
0
install
true
install_file
i429caug.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  53b8dcceea2bd8a47b85b8f488e427d8e4ef36565c752749aa728fc6a06a3321
- Size 45KB
- SHA256 53b8dcceea2bd8a47b85b8f488e427d8e4ef36565c752749aa728fc6a06a3321
- MD5 aaf65b5deb409d9fb1db19ab52296616
- SHA1 9100d76202ab0b2a45ac6bfb868853d9df16a1e8
- SHA512 91e524f788cc27adacd969cc1eed340fa83c36443560e889513dd142f3ab1ea494836be878fd09c58e844ac28404e88c738b7fa994b57a074cfde337dbd0a8ab
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1mGsGx8OHuPI2zjbEgp3iYy2M7nmFydp91Mhm62n:cu6YepTPso2rez323bLpSYy2A7p9jIS3
- TLSH
  T197232B0037E9812BF2BE4FB898F26145467AF6637603D6492CC441DB5613FC6DA426EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat command_and_control
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2